All checks
Medium
IAM identities should not have the AWSCloudShellFullAccess policy attached
Checks that no IAM user, role or group has the AWS managed policy AWSCloudShellFullAccess attached directly. It allows file transfer between a local machine and a CloudShell environment that has sudo and internet access, a way to move data out of the account. A user who gets it only through a group passes, and the group fails.
- service
- IAM
- severity
- Medium
- scope
- evaluated once per account
How to fix it
- Can break clients: Anyone using CloudShell through this identity loses it as soon as the policy is removed; attach any replacement policy first.
- Affects another check: Moving it to a group, as IAM.2 asks of a user's policies, leaves this check failing on the group; remove it outright.
In the console
IAM → Users, Roles or User groups → the identity → Permissions policies
- Permissions policies
- Remove AWSCloudShellFullAccess; on the CLI, use detach-role-policy or detach-group-policy for a role or group
- Add permissions
- If CloudShell is needed: a custom policy denying cloudshell:GetFileUploadUrls and cloudshell:GetFileDownloadUrls
With the AWS CLI
aws iam detach-user-policy --user-name <user-name> --policy-arn arn:aws:iam::aws:policy/AWSCloudShellFullAccessSee which of your accounts this check is failing on.
Book a live scan